Homeland Security proposes delayed Real ID rollout

Update 1:03 p.m. PST: This story was updated to add reactions from Congress and additional information about the privacy and security aspects of the Real ID rules.

WASHINGTON--If the Bush administration gets its way, all Americans will be required to present Real ID-compliant identification documents--or risk facing "inconveniences" at airports and federal buildings--by 2017.

In a matter-of-fact outline of the final rules governing the controversial program, U.S. Department of Homeland Security Secretary Michael Chertoff on Friday vowed to counteract the naysayers and defend what he called a "more secure form of identification that will serve both our homeland security and our individual concerns about personal privacy."

Only three categories of people need be "disappointed" by the forthcoming identification cards, the Homeland Security chief told attendees at a midday press conference here: terrorists, illegal immigrants, and con-men.

The nearly 300 pages worth of guidelines for states put forth Friday came after the agency reviewed some 21,000 comments responding to draft regulations from last March.

The Real ID Act, which Congress passed as part of an emergency spending bill in 2005, is the result of recommendations from the 9/11 Commission. Chertoff reiterated Friday that the program is necessary in part because all but one of the hijackers in the September 11 attacks carried government-issued identification cards that helped them remain in the country illegally. Another goal is to prevent illegal immigrants from "pretending to be American citizens so they can work illegally in this country."

To that end, under the new rules, motor vehicle offices will be required to take photographs of driver's license applicants at the beginning of the application process and keep those images on file for five years. The idea is to help catch applicants who forge their identities--and fail to fool employees into issuing them cards--if they try to pull off a repeat attempt.

Whether the final rule will hold up through the decadelong implementation process remains to be seen. Prominent Democrats in Congress were quick to attack the approach.

"While fulfilling this 9/11 Recommendation is vital to our national security, I believe that the Final Rule still requires a great deal of work by the Department of Homeland Security," Rep. Bennie Thompson (D-Miss.), chairman of the House of Representatives Homeland Security Committee, said in a letter Friday.

Sen. Patrick Leahy, chairman of the Senate Judiciary Committee, said in a statement that he would continue to push for passage of a bill that would repeal the Real ID Act. That mandate would be replaced with what supporters say is a more "flexible" approach, in which states, privacy groups, the federal government, and other interested parties would devise a mutually beneficial approach to improving driver's license security.

New timeline
Arguably the biggest change in the final rule is the timeline. States will generally have a larger chunk of time, broken into "milestones," to become compliant with the new standards. Earlier in the planning process, Homeland Security had envisioned requiring the IDs to be in place starting on May 11, 2008--and no later than 2013--unless states had applied for an extension.

The final rule dictates that by the end of 2009, states will have to complete certain checks on all residents who apply for driver's licenses, such as verifying against Homeland Security databases that the cardholders have legal immigration status and ensuring that the Social Security number provided matches with Social Security Administration records. States will also have to conduct background checks on motor vehicles employees "to ensure licenses are not issued by corrupt insiders."

By May 11, 2011, states are expected to have methods in place to verify that the identity documents provided by driver's license applicants, such as birth certificates, are valid. They'll also be expected to start issuing Real ID-compliant licenses by then, if not sooner.

By Dec. 1, 2014, all Americans under the age of 50 will be expected to present Real ID-compliant licenses when boarding airplanes and entering federal buildings. Exactly three years later, all Americans, regardless of age, will have to meet those requirements.

Opponents of the Real ID plan said the deadline extensions do nothing to change their view that the requirements are unworkable.

"What the Department of Homeland Security has done is to kick the can down the road to the next administration, and probably not just to the next administration, but conceivably two to three administrations from now," Barry Steinhardt, an ACLU attorney, said on a conference call with reporters.

One key part of the timeline, however, remains unchanged, which may create a new dilemma for states that have opposed or outright rejected implementation of Real ID.

If states haven't asked the federal government for an extension for implementing the identification card program by 60 days after the final rule is formally published, which has not yet happened, then their residents will no longer be able to use driver's licenses or state-issued ID cards to board airplanes or enter federal buildings. Instead, they'll have to present one of the alternative acceptable forms of identification, such as a State Department-issued passport.

"There's no question the law creates a very powerful incentive for states getting on board with this process," Chertoff said Friday. "Convenience and common sense strongly counsel in favor of getting on the path toward secure identification."

According to Chertoff, 40 percent of the U.S. population live in states that have already begun the process of moving forward with Real ID. But 17 states have passed legislation registering their opposition to the regulations, of which six of those--Maine, Montana, New Hampshire, Oklahoma, South Carolina, and Washington--expressly prohibit compliance with Real ID.

In the ACLU's view, the threat of "inconvenience" to state residents who don't sign onto the plan is largely empty since alternative forms of ID will be accepted.

"This is an avoidable train wreck," Steinhardt said.

The states that have voiced resistance to Real ID have done so largely because of the hefty price tag, which Homeland Security initially estimated at $23 billion total, of which $14.6 billion would fall on state governments to pay.

Lingering funding, privacy concerns
Chertoff on Friday touted that under the final rule, the agency was able to cut that estimated cost to $3.9 billion. He also said that, based on dividing that cost by the number of Americans estimated to be applying for such a card, each Real ID-compliant license would cost only $8 (although whether states would actually charge that amount was another story, he added).

That substantial reduction drew skepticism from the ACLU, which claimed the adjusted figure is based on the assumption that one in every four adults "isn't ever going to get a Real ID license."

Another challenge is that Congress still hasn't appropriated anywhere near that amount of money to the states, William Pound, executive director of the National Conference on State Legislatures, said in a statement.

David Quam, a lobbyist for the National Governors Association, said state officials were still reviewing the mountain of regulations but would have some tough decisions to make in the coming weeks. He said it's too early to say whether they'll request additional time to make a decision about whether to comply.

"States and legislators and decision makers are going to have to turn around and make a decision as to what does Real ID mean, what does it bring us, and is it worth it," he said in a telephone interview.

Under the minimum standards set by the Real ID Act, all compliant licenses must contain all of the information typically on a driver's license--that is, a person's name, address, signature, date of birth, gender, photograph, and license number. In addition, they must contain physical security features designed to make them counterfeit-proof and use a "common, machine-readable technology."

That machine-readable requirement--and a lack of requirement that the encoded information be encrypted--has ignited concerns among privacy advocates who worried information could be swiped off the cards and used willy-nilly by bars, clubs, and other outsiders who may swipe the cards' bar code.

Those groups said their worries were hardly assuaged by Friday's final rule. Homeland Security kept the lack of encryption requirement because, in its words, of "law enforcement's need for easy access to the information and the complexities and costs of implementing an encryption infrastructure."

The final rule also leaves states responsible for setting minimum privacy standards for how such information may be used by third parties. That means "if any state in the country has weak or no privacy standards, every other state is going to be subjecting its citizens' information to a weak standard able to be stolen by identity thieves and harvested by people who want to share that information and sell it to other people," said Tim Sparapani, the ACLU's senior legislative counsel.

Melissa Ngo, an Electronic Privacy Information Center representative, said her organization still has major concerns about the Real ID requirements but cited one positive point: The latest rules do not compel states to embed radio-frequency identification chips in the cards. Such a requirement could have created the possibility that outsiders could skim off information more easily without the cardholder's permission.